CVE-2026-74767: CWE-434 Unrestricted Upload of File with Dangerous Type in pandora-analysis pandora
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service. The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
AI Analysis
Technical Summary
CVE-2026-74767 describes a denial-of-service vulnerability in the Pandora software (pandora-analysis project) affecting versions up to and including 1.12.5. The issue occurs during the extraction of internal ISO images from DAA (Direct Access Archive) files. Pandora used zlib.decompress() without limiting the size of decompressed data, allowing an attacker to craft a DAA file that decompresses into an excessively large amount of memory, leading to resource exhaustion. The patch replaces this with bounded decompression using decompressobj().decompress() with a maximum extracted file size limit, raising a ZipBomb exception to abort extraction when limits are exceeded.
Potential Impact
An attacker can cause Pandora to consume excessive memory and CPU resources by submitting a specially crafted DAA file, resulting in denial of service through unresponsiveness or termination of the extraction worker. This impacts the availability of the Pandora service but does not involve privilege escalation or data disclosure.
Mitigation Recommendations
A fix has been implemented that enforces bounded decompression with a maximum extracted file size limit and aborts extraction if the limit is exceeded. Users should upgrade to versions later than 1.12.5 where this patch is applied. Patch status is not explicitly stated in the input data, so verify the vendor advisory for the exact fixed version and remediation guidance.
CVE-2026-74767: CWE-434 Unrestricted Upload of File with Dangerous Type in pandora-analysis pandora
Description
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service. The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74767 describes a denial-of-service vulnerability in the Pandora software (pandora-analysis project) affecting versions up to and including 1.12.5. The issue occurs during the extraction of internal ISO images from DAA (Direct Access Archive) files. Pandora used zlib.decompress() without limiting the size of decompressed data, allowing an attacker to craft a DAA file that decompresses into an excessively large amount of memory, leading to resource exhaustion. The patch replaces this with bounded decompression using decompressobj().decompress() with a maximum extracted file size limit, raising a ZipBomb exception to abort extraction when limits are exceeded.
Potential Impact
An attacker can cause Pandora to consume excessive memory and CPU resources by submitting a specially crafted DAA file, resulting in denial of service through unresponsiveness or termination of the extraction worker. This impacts the availability of the Pandora service but does not involve privilege escalation or data disclosure.
Mitigation Recommendations
A fix has been implemented that enforces bounded decompression with a maximum extracted file size limit and aborts extraction if the limit is exceeded. Users should upgrade to versions later than 1.12.5 where this patch is applied. Patch status is not explicitly stated in the input data, so verify the vendor advisory for the exact fixed version and remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CIRCL
- Date Reserved
- 2026-08-15T21:56:41.828Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a80e422bf8831d539c6ce9f
Added to database: 08/15/2026, 22:11:46 UTC
Last enriched: 08/23/2026, 13:17:51 UTC
Last updated: 09/07/2026, 10:52:11 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.